sshd_approved_ciphers='aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr'


CONF_FILE=/etc/crypto-policies/back-ends/opensshserver.config
LOCAL_CONF_DIR=/etc/crypto-policies/local.d
LOCAL_CONF_FILE=${LOCAL_CONF_DIR}/opensshserver-ssg.config
correct_value="-oCiphers=${sshd_approved_ciphers}"

# Test if file exists, create default it if not
if [[ ! -s ${CONF_FILE} ]] || ! grep -q "^\s*CRYPTO_POLICY=" ${CONF_FILE} ; then
    update-crypto-policies --no-reload # Generate a default configuration
fi

# Get the last occurrence of CRYPTO_POLICY
last_crypto_policy=$(grep -Eo "^\s*CRYPTO_POLICY='[^']+'" ${CONF_FILE} | tail -n 1)

# Copy the last CRYPTO_POLICY value to the local configuration file
if [[ -n "$last_crypto_policy" ]]; then
    if ! grep -qe "$correct_value" <<< "$last_crypto_policy"; then
        # If an existing -oCiphers= is found, replace it
        # Else, append correct_value before the closing apostrophe
        if [[ "$last_crypto_policy" == *"-oCiphers="* ]]; then
            last_crypto_policy=$(echo "$last_crypto_policy" | sed -E "s/-oCiphers=\S+/${correct_value}/")
        else
            last_crypto_policy=$(echo "$last_crypto_policy" | sed -E "s/'[[:space:]]*$/ ${correct_value}'/")
        fi
        # Write updated line to LOCAL_CONF_FILE
        echo -e "\n$last_crypto_policy" > "$LOCAL_CONF_FILE"
    fi
else
    echo -e "\nCRYPTO_POLICY='${correct_value}'" > ${LOCAL_CONF_FILE}
fi

update-crypto-policies --no-reload

- name: XCCDF Value sshd_approved_ciphers # promote to variable
  set_fact:
    sshd_approved_ciphers: !!str aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
  tags:
    - always

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Set relevant paths and correct value'
  ansible.builtin.set_fact:
    opensshserver_path: /etc/crypto-policies/back-ends/opensshserver.config
    local_path: /etc/crypto-policies/local.d/opensshserver-ssg.config
    correct_value: -oCiphers={{ sshd_approved_ciphers }}
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Ensure crypto config exists'
  ansible.builtin.stat:
    path: '{{ opensshserver_path }}'
    follow: true
  register: opensshserver_file
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Generate default config if missing or empty'
  ansible.builtin.command: update-crypto-policies --no-reload
  when: not opensshserver_file.stat.exists or opensshserver_file.stat.size == 0
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Read opensshserver.config content'
  ansible.builtin.slurp:
    src: '{{ opensshserver_path }}'
  register: ssh_config_raw
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Extract last CRYPTO_POLICY line'
  ansible.builtin.set_fact:
    last_crypto_policy: '{{ (ssh_config_raw.content | b64decode).splitlines() | select(''match'',
      "^\s*CRYPTO_POLICY=''[^'']+''") | list | last | default('''') }}'
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Check if correct_value is present'
  ansible.builtin.set_fact:
    cipher_is_correct: '{{ correct_value in last_crypto_policy }}'
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Extract current Ciphers if needed'
  ansible.builtin.set_fact:
    existing_cipher: '{{ (last_crypto_policy | regex_findall(''(-oCiphers=\S+)'',
      ''\1'')) | last | default('''') }}'
  when: not cipher_is_correct and last_crypto_policy != ''
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Build full updated CRYPTO_POLICY line'
  ansible.builtin.set_fact:
    updated_crypto_policy: '{% if last_crypto_policy == '''' %} CRYPTO_POLICY=''{{
      correct_value }}'' {% elif existing_cipher != '''' %} {{ last_crypto_policy
      | regex_replace(existing_cipher, correct_value) }} {% else %} {{ last_crypto_policy[:-1]
      ~ " " ~ correct_value ~ "''" }} {% endif %}'
  when: not cipher_is_correct
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Ensure local.d dir exists'
  ansible.builtin.file:
    path: '{{ local_path | dirname }}'
    state: directory
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Write CRYPTO_POLICY to local config'
  ansible.builtin.lineinfile:
    path: '{{ local_path }}'
    line: |-
      {{ '
      ' ~ updated_crypto_policy }}
    create: true
    insertafter: EOF
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config:
    Apply updated crypto policies'
  ansible.builtin.command: update-crypto-policies --no-reload
  tags:
  - CCE-85897-7
  - DISA-STIG-RHEL-08-010291
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_opensshserver_conf_crypto_policy
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy